chore: resolve open dependabot security alerts - #253
Conversation
📝 WalkthroughWalkthroughThe generated Go client is refreshed, including renamed enum identifiers, removed bearer-auth declarations, manifest capability response headers, and parsing changes. Angular integration dependencies, development tooling, and package overrides are also upgraded. ChangesGenerated API client
Angular integration tooling
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant HTTPResponse
participant ResponseParser
participant RuntimeBinder
participant ResponseWrapper
HTTPResponse->>ResponseParser: return successful manifest response and capability header
ResponseParser->>RuntimeBinder: bind X-Manifest-Capabilities
RuntimeBinder->>ResponseWrapper: populate status-specific headers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates the Angular integration test project dependencies to address outstanding Dependabot security alerts by upgrading Angular/Vite and related tooling, plus adding targeted npm overrides.
Changes:
- Upgraded Angular dependencies from
19.2.25to20.3.25and aligned Angular-related dev tooling (@angular/compiler-cli,typescript). - Bumped Vite from
6.4.2to6.4.3(including an override) and refreshed the lockfile accordingly. - Added an override for
@babel/coreto address a transitive vulnerability.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| test/angular-integration/package.json | Updates Angular/Vite/TypeScript versions and adds @babel/core override to resolve security alerts. |
| test/angular-integration/package-lock.json | Regenerates the lockfile to reflect the dependency upgrades and new overrides. |
Files not reviewed (1)
- test/angular-integration/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address Copilot review feedback on PR #253: @openfeature/angular-sdk 1.3.1 requires @openfeature/web-sdk ^1.9.0 as a peer dependency, but package.json still allowed ^1.7.3. Bump the declared range to match and regenerate the lockfile. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
Pull request was converted to draft
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
internal/api/client/sync_client.gen.go (1)
797-905: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd regression tests for
X-Manifest-Capabilitiesparsing.Cover each success status with the header present and absent, and verify that non-success responses do not populate the success-header wrapper. This protects the new public response contract from generator or parser regressions.
Also applies to: 932-988, 1015-1064, 1091-1154, 1322-1339, 1398-1413, 1464-1480, 1544-1562
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/api/client/sync_client.gen.go` around lines 797 - 905, Add regression tests for the response parsing paths associated with GetOpenfeatureV0ManifestResponse and the other affected response types, covering every success status with X-Manifest-Capabilities present and absent. Assert the header value is populated only when present, and verify non-success responses leave the success-header wrapper unset. Reuse the existing generated-client test patterns to cover all listed affected endpoints.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/angular-integration/package.json`:
- Line 36: Update the fast-uri dependency entry in the test Angular integration
package manifest from the caret range to the exact version 3.1.4. If this
project tracks dependency resolution in a lockfile, regenerate or update it so
the locked fast-uri version remains exactly 3.1.4.
---
Nitpick comments:
In `@internal/api/client/sync_client.gen.go`:
- Around line 797-905: Add regression tests for the response parsing paths
associated with GetOpenfeatureV0ManifestResponse and the other affected response
types, covering every success status with X-Manifest-Capabilities present and
absent. Assert the header value is populated only when present, and verify
non-success responses leave the success-header wrapper unset. Reuse the existing
generated-client test patterns to cover all listed affected endpoints.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4a5a9502-deff-459c-b1ef-5c81ee8e998e
⛔ Files ignored due to path filters (1)
test/angular-integration/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (2)
internal/api/client/sync_client.gen.gotest/angular-integration/package.json
| "@babel/core": "^7.29.6", | ||
| "esbuild": "^0.28.1", | ||
| "fast-uri": "^3.1.2", | ||
| "fast-uri": "^3.1.4", |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== package manifest =="
cat -n test/angular-integration/package.json | sed -n '1,80p'
echo
echo "== lockfile fast-uri entries =="
if [ -f test/angular-integration/package-lock.json ]; then
rg -n '"fast-uri"|"node_modules/fast-uri"|version' test/angular-integration/package-lock.json | head -120
fi
echo
echo "== any fast-uri mentions =="
rg -n '"fast-uri"|fast-uri' test/angular-integration || true
echo
echo "== npm semver semantic check =="
node - <<'JS'
const semver = require('semver');
const semverLib = require('semver');
console.log('available:', typeof semver, !!semverLib);
if (semver && semverLib) {
console.log('3.1.4 satisfies ^3.1.4:', semverLib.satisfies('3.1.4', '^3.1.4'));
console.log('3.2.0 satisfies ^3.1.4:', semverLib.satisfies('3.2.0', '^3.1.4'));
console.log('3.1.4 satisfies 3.1.4:', semverLib.satisfies('3.1.4', '3.1.4'));
console.log('3.2.0 satisfies 3.1.4:', semverLib.satisfies('3.2.0', '3.1.4'));
}
JSRepository: open-feature/cli
Length of output: 6849
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== fast-uri lockfile block =="
sed -n '2430,2470p' test/angular-integration/package-lock.json
echo
echo "== deterministic semver ranges =="
node - <<'JS'
const { satisfies } = require('semver');
for (const [version,.range] of [
['3.1.4', '^3.1.4'],
['3.2.0', '^3.1.4'],
['3.1.4', '3.1.4'],
['3.2.0', '3.1.4'],
]) {
console.log(`${version} satisfies ${range}: ${satisfies(version, range)}`);
}
JSRepository: open-feature/cli
Length of output: 2176
Pin fast-uri exactly to 3.1.4.
"^3.1.4" still allows later 3.x releases, so the manifest can diverge from the stated 3.1.4 constraint; use "3.1.4" and update the lockfile if exact reproducibility is required.
Proposed fix
- "fast-uri": "^3.1.4",
+ "fast-uri": "3.1.4",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "fast-uri": "^3.1.4", | |
| "fast-uri": "3.1.4", |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/angular-integration/package.json` at line 36, Update the fast-uri
dependency entry in the test Angular integration package manifest from the caret
range to the exact version 3.1.4. If this project tracks dependency resolution
in a lockfile, regenerate or update it so the locked fast-uri version remains
exactly 3.1.4.
Source: MCP tools
Summary
Resolved 9 open Dependabot security alerts in
test/angular-integrationby upgrading vulnerable dependencies.Dependabot Alerts Resolved
fast-uri^3.1.4(fixes host confusion via literal backslash authority delimiter)fast-uri^3.1.4(fixes host confusion via failed IDN canonicalization)vite^6.4.3in devDependencies and overridesvite^6.4.3in devDependencies and overrides@babel/core@babel/core: ^7.29.6override (transitive via@angular/compiler-cli)@angular/core@angular/common@angular/common@angular/compilerThe Angular 19.x vulnerabilities have no patch in the 19.x line; the advisories are fixed in Angular 20.3.25+. The integration test suite has been upgraded to Angular 20 accordingly, along with compatible versions of
@openfeature/angular-sdk(1.3.1),@angular/compiler-cli,@analogjs/vitest-angular, and TypeScript (~5.8.0, required by Angular 20).fast-uri(transitive viaajv/@angular-devkit) is pinned via override to^3.1.4.All 58 integration tests pass after the upgrades.